The negotiating mandate EU ambassadors agreed on October 21, 2026 would let websites and apps store or read information on a device without asking for consent in six situations, and only six. The list, written into a rewritten Article 5(3) of the ePrivacy Directive in Council document 14756/26, covers network transmission, services a user asked for, first-party audience counting, media audience measurement, technical security and the measurement of contextual advertising, a purpose the Commission had never proposed. Each purpose comes with conditions that decide who may do the processing, what data may be kept and with whom it may be shared.

In Short

Under the plan EU governments agreed, websites would still have to ask before putting most cookies on a phone or computer, but not for six specific jobs, such as keeping items in a shopping basket, counting visitors or checking how an ad matched to the page performed. Each job has strict limits: the data cannot be used for anything else, and measurement of ads cannot look at what a person did on other sites or on earlier visits. The list is not law yet, because the European Parliament still has to agree its own version and negotiate with governments.

Where the list sits and how it reads

The six purposes appear on pages 156 to 157 of the annex to document 14756/26, circulated by the Council's General Secretariat on October 22. Changes compared with the European Commission's November 19, 2025 proposal are marked in bold, and deletions in strikethrough. In a press release on October 21, the Council said talks with the European Parliament can only begin once Parliament has adopted its own position.

The rewritten paragraph opens with the general rule. "Member States shall ensure that the storing of information, or gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed when that person has given his or her consent, in accordance with Regulation (EU) 2016/679," according to the Council text.

The exceptions follow in a single sentence. "Storing of information, or gaining of access to information already stored, in the terminal equipment of a subscriber or user without consent, and subsequent processing of personal data for the same purpose, shall be lawful to the extent it is solely related to and strictly necessary for the following purposes," the text states, before listing points a) to f).

Three features of that sentence shape everything below it. The first is the threshold. The Commission had proposed that access without consent would be lawful "to the extent it is necessary for any of the following." The Council replaced that with "solely related to and strictly necessary for," a double test that requires both a link to the purpose and strict necessity. The second is the scope of later use: what is allowed is "subsequent processing of personal data for the same purpose," which rules out repurposing at the level of the opening sentence, before any individual condition applies. The third is the object. The Council's version speaks of "information," not "personal data," so the rule covers any reading of a device, whether or not what is read identifies anyone.

In its preamble, the text describes this as "a limitative list of purposes." Anything not on it needs consent, or a legal basis in Union or national law.

What the Commission proposed, and what the Council struck

The Commission's plan had been structurally different. It proposed moving cookie rules for natural persons out of the ePrivacy Directive and into the GDPR, as a new Article 88a, with a companion Article 88b requiring websites to honour automated, machine-readable consent signals. Under the Commission's draft, the old Article 5(3) would have gained a sentence stating that it "shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data."

The mandate strikes all of that. Article 88a and Article 88b are struck through in their entirety on pages 143 to 145 of the annex, and the parallel provisions the Commission had written into the regulation governing EU institutions, Regulation (EU) 2018/1725, are struck as well. PPC Land reported in June that the Council had removed the browser signal in Article 88b, and in September that a Presidency text had deleted Articles 88a and 88b. The agreed text confirms both.

The Commission's Article 88a had four exempt purposes, numbered (a) to (d):

  • "carrying out the transmission of an electronic communication over an electronic communications network";
  • "providing a service explicitly requested by the data subject";
  • "creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use";
  • "maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service."

The Council kept the first and rewrote the other three. It then added two purposes the Commission had not proposed: media audience measurement under the European Media Freedom Act, and contextual advertising measurement. Four became six.

For comparison, the ePrivacy Directive as it stands has two exemptions: technical storage or access for the sole purpose of carrying out a transmission, and storage or access strictly necessary to provide a service the user explicitly requested. Audience measurement and ad measurement cookies therefore generally need consent today unless a national regulator has carved out room in its own guidance, as France's CNIL has done for analytics. PPC Land reported in July 2025 that the CNIL had updated its audience measurement exemption, with conditions including first-party cookies only, a recommended 13-month tracker lifespan and a ban on cross-site tracking.

Purpose a): transmission

The first purpose reads: "carrying out the transmission of an electronic communication over an electronic communications network." The wording is identical to the Commission's, and the substance matches the existing directive. It covers storage or access that a network needs to deliver a communication at all, such as load balancing or routing information. Nothing in this purpose touches advertising or measurement.

Purpose b): a service the user asked for

The second purpose is "providing a service, including its functionality, explicitly requested by the subscriber or user." The Commission had written "providing a service explicitly requested by the data subject." The Council's changes are two: "data subject" becomes "subscriber or user," consistent with the move back into the ePrivacy Directive, and the words "including its functionality" are added.

The preamble explains what that addition is meant to capture. "Consent should not be required, where placing of information on or gaining access to information stored is necessary to provide a service explicitly requested by user or subscriber," recital 44c reads. "This should include placing of information or gaining access to information stored for the purpose of ensuring certain functionalities necessary for the service explicitly requested by the user or subscriber."

The recital lists examples. These "could include memorising the user's choices and selected elements such as, among others, the user's language settings, configuration choices, items placed in shopping baskets, information to facilitate filling in of online forms, or functionalities of a requested service related to information on vehicles."

The list is illustrative ("among others"), and the binding test remains "explicitly requested." A language cookie set after a user picks a language fits. A cookie that remembers a basket on an e-commerce site fits. The reference to vehicles points at connected cars, where a requested service may need data held in the car itself. None of the examples involves advertising, and the operative wording gives no indication that an ad-funded publisher could treat advertising as part of the service a reader explicitly requested.

Purpose c): counting one's own audience

The third purpose is the one most website analytics would rely on. It reads in full: "Creating anonymous aggregated information about the usage of an online service to measure the audience of that service, provided that it is carried out by the provider of the service requested by the subscriber or user, or by a third party on behalf of that provider, and the data collected for the purpose of aggregating the information are not processed for another purpose, shared with third parties or combined with data from third parties."

Set against the Commission's version, the changes cut both ways.

Wider. The Commission limited the purpose to processing "carried out by the controller of that online service solely for its own use." The Council allows "a third party on behalf of that provider." That opens the door to an outside analytics vendor, provided it acts for the site, not for itself.

Narrower. The Council adds the word "anonymous" before "aggregated information," and three prohibitions on the collected data: no processing "for another purpose," no sharing "with third parties," and no combination "with data from third parties."

The recital fills in what that means in practice. "In order to improve their services, providers of online services should be able to gain information about the use of their service on an aggregated level without analysing individual subscriber or user behaviour," recital 44d reads. "The aggregated data used for such measurement should not relate to a specific data subject and should therefore be anonymous."

It also spells out the combination ban. Data used for this purpose "should not be further processed for another purpose nor combined with data from other services from the provider of the online service or from a third party, such as analytics information from other websites." That language reaches not only outside data but also a provider's own other services. A company running several websites could not merge their analytics under this purpose.

One distinction runs through the recital. The raw data may not be shared, but the output may. "The aggregated information could be shared with third parties, including companies and non-commercial organizations," according to recital 44d. A publisher could therefore publish or sell its audience totals, while the underlying event data stays with the publisher and its vendor.

How a vendor that serves many clients can show it does not combine data across them is not addressed. The phrase "analytics information from other websites" suggests that benchmarking across a vendor's client base, a common feature of analytics products, falls outside this purpose.

Purpose d): media audience measurement

The fourth purpose is new. It reads: "performing audience measurement in compliance with Article 24 of Regulation (EU) 2024/1083, provided that personal data are pseudonymised after collection and not processed for another purpose, that the processing of personal data does not involve tracking the activity of the subscriber or user outside of the service or the media content to be measured, and that any information shared with third parties other than those acting either on behalf of or jointly together with that provider does not contain personal data."

Regulation (EU) 2024/1083 is the European Media Freedom Act, and its Article 24 deals with audience measurement systems. The ePrivacy purpose ties exemption from consent to compliance with that article.

The recital explains the reasoning. "Regulation (EU) 2024/1083 emphasises the importance of audience measurement for evaluating the performance of media content and understanding the preferences of audiences in order to plan the future production of content and for the purposes of decisions regarding advertising allocation and pricing, as well as for fostering transparency and verifiability of audiences," recital 44e states. Such measurement "should be in principle carried out in accordance with widely accepted industry self-regulatory mechanisms, such as joint industry committees, and is often conducted by independent entities acting as joint controllers."

Four conditions apply:

  • personal data must be pseudonymised after collection;
  • they must not be "processed for another purpose";
  • the processing must not track the user "outside of the service or the media content to be measured";
  • anything shared with third parties, other than those working on behalf of or jointly with the provider, must contain no personal data.

Compared with purpose c), this one allows more. The data need not be anonymous; pseudonymisation after collection is enough. Joint controllers are expressly allowed. That fits the way joint industry committees work, where a measurement company, broadcasters and publishers may jointly decide how a panel or census measurement runs. The recital refers to "collecting data about the number and characteristics of users of media services or users of content on online platforms," and characteristics go beyond simple counts.

The limits are spelled out in the same recital. "The limitations should ensure that the personal data collected is not reused for providing personalised advertising, profiling or other unrelated purposes," it reads. Reports "containing anonymous and aggregated information could be shared with third parties, including companies and non-commercial organisations."

The recital presents the exemption as a media policy measure. Exempting this measurement "should contribute to the sustainability of the media ecosystem," according to recital 44e.

Purpose e): technical security

The fifth purpose is "maintaining or restoring the technical security of the means strictly necessary for the provision of a service requested by the subscriber or user or the technical security of the terminal equipment used for the provision of such service."

The Commission had written "maintaining or restoring the security of a service provided by the controller and requested by the data subject or the terminal equipment used for the provision of such service." The Council adds "technical" twice and replaces "a service" with "the means strictly necessary for the provision of a service." The effect is to tie the purpose to the infrastructure behind a requested service rather than to the service in general.

The recital explaining it, recital 44f, reads mostly like a rule for software updates. Security processing without consent "should only be allowed without consent to the extent that the security measures, such as security updates, are strictly necessary and proportionate," are "provided separately from functionality updates where technically feasible," and "do not introduce changes to functionality, interactions with other software or settings chosen by the subscriber or user beyond what is strictly necessary and proportionate for that security purpose." The recital adds: "The subscriber or user has the possibility to turn off the automatic installation of these updates."

It then defines the scope broadly. Maintaining security "should include in particular cybersecurity and the necessary security requirements to ensure a proper functioning of the terminal equipment as well as the protection of personal data and privacy of the user."

The text does not mention fraud. Whether bot detection or ad fraud filtering on a publisher's pages counts as "technical security of the means strictly necessary" for a requested service is not settled by the wording. Invalid traffic checks that protect an advertiser, rather than the service the user asked for, appear harder to fit.

Purpose f): contextual advertising measurement

The sixth purpose is the one the advertising market has followed most closely, and it is the longest. It reads:

"measuring the display and performance of advertising that is based solely on the immediate content displayed on a subscriber or user's online interface during an individual visit or on the basis of a single search query and that does not involve the processing of personal data, where such measurement is carried out by the provider of an online service, including jointly with others, or on behalf of that provider. Such measurement shall not involve profiling or processing of data relating to the subscriber or user's past or future activity, including activity across sites or services. Data collected for such measurement shall be pseudonymised after collection and shall not be processed for another purpose."

The provision breaks into four parts.

What kind of ad

The advertising must be "based solely on the immediate content displayed" during "an individual visit" or on "a single search query." That is a definition of contextual advertising without using the term. An ad chosen because a page is about running shoes qualifies. An ad chosen because the device visited a running-shoe retailer last week does not. The single search query is significant for search advertising: an ad matched to the keywords of one query, without regard to earlier searches, falls within the definition.

The ad itself must also be one "that does not involve the processing of personal data." Grammatically, that clause attaches to the advertising, not to the measurement. Selection and delivery of the ad must run without personal data.

The recital sets out why measurement is needed at all. "The simple display of contextual advertising does not typically require access to or storing of information on a user or subscriber's device," recital 44g reads. "At the same time, the effectiveness of such advertising often relies on the possibility to measure the display and the performance of the advertisement displayed such as capping cookies and advertising measurement cookies."

That sentence is the only place where the text names cookies by what they do. "Capping cookies" refers to frequency capping, which limits how often the same ad is shown.

Who may measure

Measurement may be "carried out by the provider of an online service, including jointly with others, or on behalf of that provider." The words "jointly with others" go further than purpose c), which only allows a third party "on behalf of" the provider. A publisher and an ad server or measurement vendor could therefore be joint controllers of contextual ad measurement and still rely on the exemption. The text does not name advertisers, agencies or demand-side platforms. Whether an advertiser's own measurement tag on a publisher page fits "jointly with others" is not addressed.

What the measurement may not do

"Such measurement shall not involve profiling or processing of data relating to the subscriber or user's past or future activity, including activity across sites or services." The recital uses a slightly wider phrase, "activity across sites, apps or services." The operative text omits the word "apps," though apps are mentioned elsewhere in the recital as an example of an online interface.

The recital also contains an exclusion that does not appear in the operative text. Data collected must not be "processed for another purpose including profiling or providing programmatic advertising," according to recital 44g. The binding text says only "shall not be processed for another purpose." Recitals guide interpretation, so the programmatic exclusion would still carry weight, but it is not written into the article itself.

What happens to the data

"Data collected for such measurement shall be pseudonymised after collection and shall not be processed for another purpose." The recital describes pseudonymisation as "a key security measure."

Where the wording leaves open questions

Read together, the parts of purpose f) raise three questions that the text does not answer.

The first concerns personal data. The advertising must not involve personal data, yet the measurement data "shall be pseudonymised after collection." Under the GDPR, pseudonymisation is an operation on personal data. The structure suggests the Council expects measurement to collect some personal data, for instance an identifier in a cookie, while the ad selection itself uses none. It does not say so explicitly.

The second concerns frequency capping. A cap works by remembering how often a device has seen an ad, which is information about earlier exposure. The article bars "processing of data relating to the subscriber or user's past or future activity." The recital nonetheless names "capping cookies" as an example of the measurement it means to cover. One reading is that a count of impressions of a single campaign on a single service is not "activity" in the sense intended, and that the prohibition is aimed at behavioural history, especially "activity across sites or services." The text does not resolve this, and supervisory authorities would have to.

The third concerns "performance." The text does not define it. Display measurement, such as whether an ad was rendered and viewable, sits comfortably within the purpose. Clicks on the ad during the same visit are arguably part of that visit. Conversion measurement is harder. A conversion typically happens later and often on the advertiser's own site, which would be "future activity" and "activity across sites." On the wording of the article, conversion tracking that links an ad view on one site to a purchase on another would fall outside the exemption.

How the clause got here

The contextual purpose had an uneven path through the Council. PPC Land reported that iubenda had said a compromise circulated around May 21, 2026 had dropped a proposed carve-out for contextual ad measurement, and that the October 2 draft brought it back as "an additional purpose." The October 2 text already contained the six purposes, and the agreed mandate keeps that architecture.

What sits around the list

The paragraph after the six purposes sets the mechanics for everything that still needs consent. Refusal must be possible "in an easy and intelligible manner with a single-click button or equivalent means," and "if the subscriber or user refuses a request for consent, the provider shall not make a new request for consent for the same purpose for a period of at least four months," according to the text. The Commission had set six months. The French advertising association Alliance Digitale had asked in May for the re-request ban to be deleted outright.

Three further additions frame the list. A new Article 15a(5) would require each member state to designate its GDPR supervisory authority "for the supervision and enforcement of the rules under this Article 5, paragraph 3." A new Article 17(3) gives member states until "[24 months after the adoption of this Regulation]" to transpose and apply the rules. And a new paragraph in Article 18 asks the Commission for a report within 12 months of adoption on "the use of privacy-enhancing technologies, including in relation to the storing of, or gaining access to information on terminal equipment," with proposals to update the framework "where appropriate."

Because the rules remain in a directive, national laws will carry them. Purposes that are tightly drafted at EU level could still be worded differently in 27 transpositions.

What the list leaves out

The list's boundaries matter as much as its contents. On the text as agreed, consent would still be required for:

  • behavioural or personalised advertising, including retargeting;
  • cross-site measurement and attribution, including conversion tracking that follows a user from an ad to another site;
  • analytics that pool data across a vendor's clients or a provider's own services;
  • any reuse of exempt measurement data for another purpose, including, per the recital, programmatic advertising;
  • product analytics that analyse individual behaviour rather than producing anonymous aggregates, which appear to fall outside purpose c) because recital 44d refers to measurement "without analysing individual subscriber or user behaviour."

The text does not mention consent management platforms, the IAB Transparency and Consent Framework, or how a vendor embedded in a page would show which of the six purposes it relies on. Courts have already shown willingness to hold vendors directly responsible: in December 2025 the Frankfurt Higher Regional Court held that third-party cookie providers can be liable for cookies placed without consent, even where the website operator had contractually taken on the duty to collect it.

Why the list matters for marketers

For publishers, the closed list is the first time EU governments have agreed in a legal text that some measurement can run without a banner. The four-to-six expansion favours measurement over targeting at every turn. Two of the new or rewritten purposes, c) and d), are about counting audiences. The third, f), is about counting ad delivery. None allows a profile to be built.

The contextual purpose is narrower than its headline suggests. It covers the measurement of contextual ads, not their targeting, which already needs no device access. Its value to the market depends on how regulators read "performance" and "past or future activity." A reading that allows impression counting and single-campaign frequency caps would give contextual campaigns basic delivery controls without consent. A reading that excludes caps would leave the exemption covering little more than viewability.

The text is also a negotiating position, not a law. The 19 organisations that wrote to the Irish Presidency in September asking for browser consent signals to return did not get them in this text, and the European Parliament, which has not voted, could reopen any of the six purposes.

Timeline

Summary

Who: The Council of the European Union, through the Permanent Representatives Committee. The list affects website and app operators, publishers, analytics vendors, joint industry committees and other audience measurement bodies, ad servers and measurement companies, and the national data protection authorities that would enforce it.

What: A closed list of six purposes in a rewritten Article 5(3) of the ePrivacy Directive for which storing or reading information on a device would need no consent: transmission, a service explicitly requested including its functionality, anonymous first-party audience measurement, media audience measurement under Article 24 of the European Media Freedom Act, technical security, and measurement of the display and performance of advertising based solely on the content of a single visit or search query. The Commission had proposed four purposes in a GDPR article the Council struck. Each purpose carries conditions on purpose limitation, sharing and, for media and contextual measurement, pseudonymisation after collection.

When: Coreper agreed the mandate on October 21, 2026, and the text was circulated on October 22, 2026. If adopted, member states would have 24 months after adoption to transpose and apply the rules.

Where: Brussels, at the Council of the European Union. The rules would apply across the EU through national laws transposing the directive.

Why: The Council text presents the list as a way to reduce compliance burden for low-risk processing. For the advertising market, it sets the member states' position on which measurement can run without a consent banner, and draws the line at profiling, cross-site activity and reuse of data.